Error loading logging conf file - can't start Splunk Enterprise Server

rdjoraev_splunk — Fri, 17 Jul 2015 22:43:53 GMT

Not able to start Splunk.

When running "./splunk start" from the command line, Splunk Enterprise Server fails to start with the following error message:

Error loading logging conf file='/opt/splunk/etc/log.cfg'; runContext=splunkd

Re: Error loading logging conf file - can't start Splunk Enterprise Server

rdjoraev_splunk — Fri, 17 Jul 2015 23:02:03 GMT

As per error message, root cause of the issue is related to log.cfg file in located the /opt/splunk/etc/ directory.

Checked in the splunkd.log file in $SPLUNK_HOME/var/log/splunk and observed the following message in it:

WARN Logger - /opt/splunk/etc/log.cfg:11: Parse error at "TailingProcessork....

It was found that the category.TailingProcessor parameter name was not spelled correctly. After updating the parameter name in the log.cfg file, user was able to start Splunk Server successfully.

topic Error loading logging conf file - can't start Splunk Enterprise Server in Installation

Error loading logging conf file - can't start Splunk Enterprise Server

Re: Error loading logging conf file - can't start Splunk Enterprise Server